How to guard against scope objects getting changed?

Question

I'm an Angular noob. In an app I have taken over there is an object in the scope that defines the role of the current user (eg user.role=REGULAR ).

Is there a way to keep a user from opening firebug and changing user.role=ADMIN ?

For example, I have seen code that shows a tab based on a value in a scope, but I'm not sure how to keep a user from changing that value (and getting access to the tab). Is there a pattern to deal with this? Does everything access-related need to come directly from a web service/protected remote location?

Answer 1

There is no way to do this . Your design has a fundamental issue; it relies on client side validation.

You can never ever ever ever ever trust anything coming from the client. Anything that you truly want validated or authenticated must be done on the server side, particularly security related matters.

The most important rule is that once it leaves the server and hits the client, its out of your control. Assume its compromised, assume its not trust-worthy, and assume you have to check everything.

In your case, if a user is not an admin don't even provide them with admin options.

Answer 2

Well, you can try to hide the object inside of a closure or use Object.freeze in browsers that support it, however there is no getting around the fact that the code is being sent to and executed on the client. Even if there was a foolproof way of preventing modification ( which there isn't ), the client could have modified the payload in Fiddler or something before it reached the browser.

With that in mind, you cannot trust anything on the client for access/authorization; you must verify this on the server or you'll have security holes/risks.